This search command creates a table of statistics and a corresponding chart to display the most frequent values of a field. The command also supports the optional group by
parameter to display the most frequent values for each distinct tuple of values of the group by
field.
The values displayed in the table of statistics and the bars displayed in the chart are clickable. When you click a value in the table, the tabular view is toggled to the search results view, and events associated with those values are displayed.
This topic contains the following information:
For a list of all search commands, see Search commands.
top limit=<int> <field> [by <field>]
In the preceding syntax,the following definitions apply:
<int>
refers to an integer value that represents the maximum number of results to return.by <field>
refers to the group by
parameter that can be optionally used to group the result set by the specified field.Example 1: Return the 10 most common values of the HOST field.
... | top limit=10 HOST
Example 2: Return the most common data-pattern values for each host.
... | top limit=5 DATA_PATTERN by HOST
Example 3: Return the most common request types based on the client IP address.
... | top limit=5 RequestType by ClientIp
Example 4: Return the most common request type.
... | top limit=1 RequestType
The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the top
command.
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.141 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp=10.1.1.141 |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
10.1.1.140 - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png HOST=local.bmc.com |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp=10.1.1.140 |ResponseCode=404 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png |
In this example, you use the command to see a table of statistics (and a multiseries chart) displaying the most used request types.
For each request type, a count indicating the number of times the request was made is displayed.
... | top limit=5 RequestType
RequestType | Count |
---|---|
GET | 2 |
POST | 1 |
PUT | 1 |
In this example, you use the command to see a table of statistics (and a multiseries chart) displaying the most common request types and to understand from which client IP addresses these request types originate.
For each request type, a count is displayed, indicating the number of times the request was made per client IP address.
... | top limit=5 RequestType by ClientIp
ClientIp | RequestType | Count |
---|---|---|
10.1.1.140 | GET | 2 |
10.1.1.141 | POST | 1 |
10.1.1.141 | PUT | 1 |
In this example, you use the command to see a table of statistics (and a multiseries chart) displaying the most common request type.
... | top limit=1 RequestType
RequestType | Count |
---|---|
GET | 2 |
In this example, you use the command to see a table of statistics (and a multiseries chart) displaying the most common request type grouped by the ClientIp field.
... | top limit=1 RequestType by ClientIp
ClientIp | RequestType | Count |
---|---|---|
10.1.1.140 | GET | 2 |
10.1.1.141 | POST | 1 |
If the number of occurrences of the field used for the by
parameter is too large (for example, 500), then the count of values displayed is an approximate value.